Issue #3242626 by phenaproxima, tedbow, TravisCarden: Determine how to...

Issue #3242626 by phenaproxima, tedbow, TravisCarden: Determine how to identify core Composer packages

core_packages.json

+[
+  "drupal/core",
+  "drupal/core-composer-scaffold",
+  "drupal/core-dev",
+  "drupal/core-dev-pinned",
+  "drupal/core-project-message",
+  "drupal/core-recommended",
+  "drupal/core-vendor-hardening"
+]

src/Updater.php

@@ -184,29 +184,17 @@ class Updater {
     $data = file_get_contents($composer);
     $data = Json::decode($data);
 
-    // @todo Find some way to either use a canonical list of packages that are
-    //   part of core, or use heuristics to detect them in the lock file (e.g.,
-    //   any package which starts with 'drupal/core-' and is a Composer plugin
-    //   or metapackage).
-    $core_packages = ['drupal/core', 'drupal/core-recommended'];
-    $requirements = array_keys($data['require']);
-
     // Ensure that either drupal/core or drupal/core-recommended are required
     // by the project. If neither is, then core will not be updated, and we
     // consider that an error condition.
-    $core_requirements = array_intersect($core_packages, $requirements);
+    $requirements = array_keys($data['require']);
+    $core_requirements = array_intersect(['drupal/core', 'drupal/core-recommended'], $requirements);
     if (empty($core_requirements)) {
       throw new \LogicException("Drupal core does not appear to be required in $composer.");
     }
 
-    // Also detect core's Composer plugins, so they can be updated if needed.
-    $core_packages = array_merge($core_packages, [
-      'drupal/core-composer-scaffold',
-      'drupal/core-vendor-hardening',
-      'drupal/core-project-message',
-    ]);
-
-    return array_intersect($core_packages, $requirements);
+    $list = file_get_contents(__DIR__ . '/../core_packages.json');
+    return array_intersect(Json::decode($list), $requirements);
   }
 
   /**

tests/src/Kernel/CorePackageManifestTest.php

+<?php
+
+namespace Drupal\Tests\automatic_updates\Kernel;
+
+use Drupal\Component\Serialization\Json;
+use Drupal\KernelTests\KernelTestBase;
+use Symfony\Component\Finder\Finder;
+
+/**
+ * Tests that core's Composer packages are properly accounted for.
+ *
+ * In order to identify which Composer packages are part of Drupal core, we need
+ * to maintain a single hard-coded list (core_packages.json). This test confirms
+ * that the list mentions all of the Composer plugins and metapackages provided
+ * by Drupal core.
+ *
+ * @todo Move this test, and the package list, to a more central place in core.
+ *   For example, the list could live in core/assets, and this test could live
+ *   in the Drupal\Tests\Composer namespace.
+ *
+ * @group automatic_updates
+ */
+class CorePackageManifestTest extends KernelTestBase {
+
+  /**
+   * Tests that detected core packages match our hard-coded manifest file.
+   */
+  public function testCorePackagesMatchManifest(): void {
+    // Scan for all the composer.json files of said metapackages and plugins,
+    // ignoring the project templates. If we are not running in git clone of
+    // Drupal core, this will fail since the 'composer' directory won't exist.
+    $finder = Finder::create()
+      ->in($this->getDrupalRoot() . '/composer')
+      ->name('composer.json')
+      ->notPath('Template');
+
+    // Always consider drupal/core a valid core package, even though it's not a
+    // metapackage or plugin.
+    $packages = ['drupal/core'];
+    foreach ($finder as $file) {
+      $data = Json::decode($file->getContents());
+      $packages[] = $data['name'];
+    }
+    sort($packages);
+
+    // Ensure that the packages we detected matches the hard-coded list we ship.
+    $manifest = file_get_contents(__DIR__ . '/../../../core_packages.json');
+    $manifest = Json::decode($manifest);
+    $this->assertSame($packages, $manifest);
+  }
+
+}

tests/src/Kernel/UpdaterTest.php

@@ -46,8 +46,8 @@ class UpdaterTest extends AutomaticUpdatesKernelTestBase {
       // git clone of Drupal core, so they will be included when determining
       // which core packages to update.
       // @see \Drupal\automatic_updates\Updater::getCorePackageNames()
-      'drupal/core-vendor-hardening:9.8.1',
       'drupal/core-project-message:9.8.1',
+      'drupal/core-vendor-hardening:9.8.1',
       '--update-with-all-dependencies',
     ];
     $stager->stage($command, Argument::cetera())->shouldBeCalled();